magiclanternfandomcom-20200223-history
Register Map/40D
Canon 40D Register Map CFDMA 0xC0700000 CF Base #0 link: http://rumkin.com/reference/aquapad/media/cfspc3_0.pdf link: https://www.mouser.com/catalog/specsheets/CF4_DS_Rev1.0.pdf Request Configuration Block +0x200 8 CF Interface block +0x2000 8 PIO DATA (used to transfer data in polled mode) +0x2001 8 Read: Error data, Write: Features +0x2002 8 Sector count +0x2003 8 Sector number +0x2004 8 Cylinder low byte +0x2005 8 Cylinder high byte +0x2006 8 Drive/Head +0x2007 8 Read: Status, Write: CF command +0x200E 8 Read: Alt Status, Write: Device control Extern DMA Controller Interface (DMA PIO mode - not polled mode) (digic3<->cf controller ?) +0x800C 32 Data register to feed with data (usually 0x2000) +0x8010 32 unknown, set to 0x100. maybe sector size? +0x8014 32 unknown, set to PIO_W:0x1E, PIO_R:0x16, DMA:0x00, +0x8024 32 PIO: CF Command register to use, OR'ed with 0xA000 +0x8028 32 PIO: set to ? +0x8030 32 PIO: set to ? +0x8034 32 PIO: set to ? or ? depending on command reg +0x8038 32 PIO: set to ? or ? depending on command reg +0x8040 32 Enable interrupt when flag changed? 0, 1, 0x2000000 +0x8044 32 Interrupt reason, write with negated value upon interrupt +0x8048 32 set to 1, maybe transfer count? Tranfer mode control registers ? (cf controller <-> cf card ?) +0x8100 32 0x0 (init) or 0x2 (software OR's with 0xFFFFFFF9 then AND with 0x2) +0x8104 32 0x4 PIO access timing registers (cf controller <-> cf card ?) +0x8108 32 access timing PIO mode - fastest mode = 0xC0 ~ 20mb/s +0x810C 32 access timing PIO mode - fastest mode = 0xC0 ~ 20mb/s +0x8110 32 access timing PIO mode - fastest mode = 0xC0 ~ 20mb/s +0x8114 32 access timing PIO mode - fastest mode = 0xC0 ~ 20mb/s Notes: When setting timing registers 0x8108-0x8114 incorrectly, the FIO_Write function will recover from any errors and return a error to the caller via return value. The FIO_Read will not, and a call will FIO_read will stall the camera. UDMA Mode Settings ? (CF identify drive command says UDMA is not supported) +0x8200 32 0x0 (?) +0x8204 32 0x0 (?) +0x8208 32 0x3FFFF (?) +0x820C 32 0x3FFFF (?) +0x8210 32 0x3FFFF (register is changable) +0x8214 32 0x3FFFF (register is changable) SDCON Interface used by CF 0xC0C..... EDMAC 16 channels only (0xC0F04000) EDMAC0 - EDMAC15 0xC0F04000 0xC0F04100 .. 0xC0F04F00 +0x00 32 DMA control -------- -------1 Start transfer / Transfer in progress +0x04 32 flags -------- -----xxx -------- -------- flags for read channels when calling StartEDmac -------- -------- -------- xx------ flags for write channels when calling StartEDmac xxx----- -------- ---x---- -----xxx flags for SetEDmac (but you can set any bit) 1------- -------- -------- -------- only one transfer, causes errors on other DMAs -10----- -------- ---1---- -------- 16 byte per transfer -01----- -------- ---1---- -------- 8 byte per transfer -10----- -------- ---0---- -------- 4 byte per transfer -01----- -------- ---0---- -------- 2 byte per transfer +0x08 32 SDRAM destination offset +0x0C 32 ((yn << 16) | xn) & 0x0FFF1FFF +0x10 32 ((yb << 16) | xb) & 0x7FFFFFFE +0x14 32 ((ya << 16) | xa) & 0x0FFF1FFF +0x18 32 off1b & 0x0001FFFE if DIGIC <= 4 else 0x0007FFFE +0x1C 32 off2b & 0x0FFFFFFE if DIGIC <= 4 else 0xFFFFFFFE +0x20 32 off1a & 0x0001FFFE if DIGIC <= 4 else 0x0007FFFE +0x24 32 off2a & 0x0FFFFFFE if DIGIC <= 4 else 0xFFFFFFFE +0x28 32 off3 & 0x0FFFFFFE if DIGIC <= 4 else 0xFFFFFFFE off1*: signed, 17 bits for DIGIC 4 or lower, 19 bits for DIGIC 5. off2*: signed, 28 bits for DIGIC 4 or lower, 32 bits for DIGIC 5. +0x30 32 interrupt reason (read on interrupt) 0x01 = normal? (used with PackMem) 0x02 = normal (transfer finished) 0x04 = pop (memsuite finished?) 0x10 = abort +0x34 32 3 = AbortEDmac +0x40 32 (fencing uses it and sets it to 0x23 which might be a connection) Current assumption: ( ((xa, skip off1a) * ya, xa, skip off2a) * xn (xb, skip off1b) * ya, xb, skip off3 ) * yn, ( ((xa, skip off1a) * yb, xa, skip off2b) * xn (xb, skip off1b) * yb, xb, skip off3 ) Previous assumption: xb: block size - number of bytes per copy operation this number must be >1 and a multiple of two (write) or four bytes (read) after this number of bytes were transmitted, an commit command is issued. write channels wait for a commit command before the block is written into memory fully. yb: block count | number of blocks to transfer xn: transaction count | how often above should get transferred ya: same as xb when more transactions? off2b: padding (positive) or cropping edmac Channels .. ''' 0x0 ; LiveView, Craw, WhiteBalance 0x1 ; LiveView, Craw, DefectsDetectPass 0x2 ; DarkSubStrctionPass, DefectsCorrectPass, BathtubCorrectPass, BathtubCorrectPass, RawEncodePath, JpegEncodePath 0x3 ; RawEncodePath, JpegEncodePath, DCF, Pony2 0x4 ; LiveView, DirectEdmacPass, VShadingCorrectionPass 0x5 ; LiveView(white balance) 0x6 ; FencingB 0x7 ; 0x8 ; LiveView, Craw 0x9 ; LiveView, Craw, BathtubCorrectPass 0xa ; DarkSubStrctionPass, obi_ObIntegPass, WhiteBalance, DefectsDetectPass, DirectEdmacPass, VObIntegPass, RawEncodePath, JpegEncodePath, DCF, Pony2 0xb ; DarkSubStrctionPass, VShadingCorrectionPass, BathtubCorrectPass, DetectFace 0xc ; VShadingCorrectionPass, FencingB 0xd ; FencingC 0xe ; 0xf ; '''Connections 0x0 ; LiveView, Craw, DarkSubStrctionPass, DefectsDetectPass, VShadingCorrectionPass, RawEncodePath, JpegEncodePath 0x1 ; DarkSubStrctionPass, FA_DefectsCorrectPass, obi_ObIntegPass, WhiteBalance, DefectsDetectPass, VShadingCorrectionPass, VObIntegPass, BathtubCorrectPass 0x2 ; Craw, WhiteBalance, JpegEncodePath 0x3 ; JpegEncodePath, DCF 0x4 ; LiveView 0x5 ; RawEncodePath, JpegEncodePath, DCF 0x6 ; LiveView, DirectEdmacPass 0x7 ; 0x8 ; LiveView, Craw 0x9 ; LiveView, Craw 0xa ; DarkSubStrctionPass, DefectsCorrectPass 0xb ; 0xc ; RequestHistPass 0xd ; 0xe ; FencingB, FencingC 0xf ; Craw, BathtubCorrectPass 0x10; VShadingCorrectionPass, BathtubCorrectPass, BathtubCorrectPass 0x11; DetectFace 0x12; Pony2, FencingB 0x13; 0x14; 0x15; LiveView 0x16; RawEncodePath .. SDCON The Canon 40D has complete software for SD support, but was released without a SD Slot. 0xC0C00000 SDCON Base (slot 0) 0xC0C10000 SDCON Base (slot 1) GPIO GPIO usage on 40D : 0xC0220050 Sdcard 0xC0220054 Sdcard 0xC02200A0 Sdcard 0xC02200A4 Sdcard 0xC02200C0 Sdcard 0xC02200C4 Sdcard 0xC02200C8 Sdcard 0xC02200CC Sdcard 0xC02200E0 camera red led 0x44/0x46 0xC02200E8 print button blue led, 0x44/0x46 0xC02200EC ? 0xC0220098 Intercom 0xC0203034 Intercom 0xC0220120 SD Power on/off 0xC0220004 chipselect ? 0xC02200D0 sio chip select channel 1 - (Display,RTC function ?) 0xC02200D4 sio chip select channel 1 - (Display,RTC function ?) 0xC02200DC sio chip select channel 1 - (Display,RTC function ?) 0xC02200EC Display ? 0xC0220104 Display, 0x44/0x46 ; display clear/ready 0xC0220108 Display ? 0xC022010C Display, 0x44/0x46 ; turn off/on LCF power 0xc022004C CS ADTG - used in writing to adtg 0xc0220114 gpio 0xc0220118 gpio 0xc0220124 cmos latchup error register 0xc022011c USB 0xc0220100 USB 0xc0220128 USB 0xc0220094 Real time clock 0xc022005C Real time clock 0xc022006c Capture 0xC0223010 Display ? 0xC0238084 Display ? 0xC0238060 Display ?